Form authentication security question!

  • Thread starter Thread starter jens Jensen
  • Start date Start date
J

jens Jensen

Hello,
When my users logs in to my site, an MD5 hashed value of the password is
sent to the server, and there the value is validated against a database.

What if someone catchs my hash value and also send it to my server. Will
that form manipulation succeed?


Many thansk in advance

JJ
 
Hi,

No, hash value of the password is created on the server after client send it
as a plaintext. The reason why are passwords stored as a hashes is to
prevent it's misuse when the database is hacked, not to transmit them
securely. So yes, form manipulation would be successfull.

Btw. I don't think that login controls would use MD5 - it's unsecure,
deprecated alghorithm.
 
You must log in or register to reply here.

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

A simple security question 5
Forms authentication cookie handling question (C#) 4
HashPasswordForStoringInConfigFile known issues ? 6
Authentication in Asp.Net 2.0 1
Trouble using MD5 and SHA1 digests 2
How Do I Implement Roles For Forms-Based Authentication? 2
Forms Authentication - how to read timeout? 1
Adding security question/answer check to ASP.NET *ChangePassword* control 2

Back
Top